x402-settlement-census

x402 settlement census — 2026-09-06

We paid 316 conformant x402 hosts as an ordinary buyer and recorded what came back. Not a survey of what hosts advertise — a record of what they did when real USDC arrived.

Two in three conformant hosts refused a correctly-signed payment. Being listed in a Bazaar index and answering a valid 402 is not the same as taking money and delivering.

Method

Buyer's-eye, exactly as a client experiences it:

1. GET the resource → 402 + a challenge (v2 header, or v1 body)
2. sign an EIP-3009 TransferWithAuthorization for accepts[0], with the EIP-712 domain taken from the challenge itself
3. GET again carrying PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1)
4. record status, bytes, content-type, latency, and the settlement tx the host reports

The payer never broadcasts a transaction and holds no ETH: the authorisation travels in a header and the host's facilitator submits it and pays gas. That is what EIP-3009 is for.

Caps, enforced in code: 0.05 USDC per host (50000 units), 5.5 USDC total. Actual spend 1.3398 USDC. Hosts asking more than the per-host cap were never contacted. Our own hosts are excluded by name — paying ourselves is a self-settlement, never a purchase.

Beneficiary concentration

174 distinct payTo addresses collect for 314 live doors — and the three largest collect for 91 of them.

A directory of many hosts is not a market of many beneficiaries, and a host count cannot show that.

Took a settlement and still refused (13 hosts)

These reported an on-chain settlement in their own PAYMENT-RESPONSE and then answered the retried request with 402/4xx anyway. Money moved; nothing was delivered. Check the chain yourself:

What this is NOT

• Not a ranking or a recommendation. No host was contacted, before or after.
• REFUSED is not proof of bad faith. A host may rate-limit, require an account, or have changed its terms between the challenge and the retry. From outside, all of those look identical.
• One purchase per host, at one moment. A single refusal is not a pattern. A second round is what would make it one.
• Not revenue. Every USDC left our own wallet. Paying anyone is a cost.
• Not certification, not a conformity mark. Measurement of what happened, and when.

The move_a_self config

A second config records our own eight doors, paid by a wallet we control. It is here so the method can be checked against a case where the answer is known, and it is labelled so nobody mistakes it for demand: a self-settlement is never revenue. /api/revenue one_number stayed 0 throughout and self_settlements rose to 5. Five doors settled (all receipts status 0x1 on Base); three are priced at 250, 25 and 25 USD by design and were not bought — settling all eight would cost about 300 USDC.

Reproduce

SETTLE=1 X402_PAYER_KEY=<throwaway> python3 scripts/grants/x402-settlement-census.py \
  --max-hosts 316 --total-cap 5.5 --out x402-settlement-census-2026-09-06.jsonl

Source population: csoai/x402-bazaar-conformance, hosts that are conformant on eip155:8453 with scheme exact and an amount inside the per-host cap.

The live board is the authority

GET https://councilof.ai/api/gspc — quote totals.public_count. This Hub card is a printer of that GET, never a second engine. If the fetch fails the honest answer is UNCHECKABLE — never a fabricated 0.000. Status words: LOADING / UNREACHABLE / UNMEASURED / UNCHECKABLE.

Lid: 23 axes measured · 14 model fleets · 0 separated leaders · 3 public leader scores · 9 fact runs · TIE is TIE · not a certificate. A public leader score is a published field, not proof of a separated leader; read each row's status and separation.

This repository: NOT A BOARD MEASUREMENT — this repository is a corpus, mirror or door published by CSOAI. It carries no axis score. The measured slots live on the board GET below.

What is in this repository

manifest.jsonl is derived from this repository's own file tree at 2026-09-27T05:00:40Z; it lists every file with its size, its blob hash and a direct URL, so an agent can enumerate the repo without cloning it.

Citation

@misc{csoai_gspc_x402_settlement_census,
  title        = {x402-settlement-census — Council of AI / GSPC},
  author       = {{CSOAI Ltd}},
  year         = {2026},
  doi          = {10.5281/zenodo.21991104},
  howpublished = {Hugging Face Hub, \url{https://huggingface.co/datasets/csoai/x402-settlement-census}},
  note         = {Live board: https://councilof.ai/api/gspc. Measurement, not certification.}
}

Measurement, not certification. Issued by CSOAI Ltd (England & Wales, Companies House 16939677), 3rd Floor, 86–90 Paul Street, London EC2A 4NE. Card refreshed 2026-09-27T05:00:40Z.

Capability + living GET (TUI7 distribution 2026-09-14)

SUPERSEDED: typed Hub triples LIVE (re-GET /api/hub-cards → counts.*) (and prior 885/900/937/1113/1182/1185) — do not re-paste. Hub cite = live GET only.

Live board: GET https://councilof.ai/api/gspc → quote totals.public_count / totals.lid (22·22·0 derived, never typed as a frozen paste)
Hub cards: GET https://councilof.ai/api/hub-cards → quote counts.cells / counts.measured / counts.unmeasured LIVE (no typed Hub triple)
Hub bank: https://huggingface.co/datasets/csoai/gspc-hub-cards
Free verify: https://councilof.ai/gspc-verify
Discovery: GET https://councilof.ai/.well-known/x402.json (live · Base · USDC)
OX discovery resources: councilof 0/60 honest — do not invent rows
Measurement, never certification. Printer only — no axis mine on ZeroGPU. A100 COLD.

Council of AI — GSPC + Hub printer

• Living board: https://councilof.ai/api/gspc — quote totals.public_count / totals.lid (never invent MEASURED)
• Hub cite: https://councilof.ai/api/hub-cards — re-GET; quote counts.* (typed LIVE (re-GET /api/hub-cards → counts.*) SUPERSEDED 2026-09-14)
• Hub dataset bank: https://huggingface.co/datasets/csoai/gspc-hub-cards
• Verify free: https://councilof.ai/gspc-verify
• x402 discovery: https://councilof.ai/.well-known/x402.json
• Catalog: https://councilof.ai/api/x402
• Free door (amount 0): https://councilof.ai/api/free-door
• Jail goldbank: https://huggingface.co/datasets/csoai/gspc-jail-goldbank
• Human: free + x402 PAYG · Coming—Paddle not live · never Stripe
• Agents: payTo is merchant receive — never the signer
• Self-settle proves the rail; stranger revenue is separate (do not invent buyers)
• Measurement, not certification. Never sell a rank. Never certify.

Any Hub x402.json in a CSOAI printer is a byte-mirror of the living well-known GET — not a second authority.

OpenX402 + free discovery (cite only · never invent OX resource rows)

OpenX402 server: Council of AI · https://councilof.ai · payTo 0x212686404a7d1e1fd88f35ed6200c3af7a78ae31
Servers API: GET https://openx402.ai/api/servers (LIVE row · registered 2026-09-14 · Base tx 0x0eb1ead995e235a2…)
Whitelist: GET https://facilitator.openx402.ai/whitelist/0x212686404A7D1E1fD88F35eD6200c3aF7A78ae31 → whitelisted true
OX discovery resources: GET https://facilitator.openx402.ai/discovery/resources → councilof still 0/60 (no free advertise API; settle-through required — do not invent rows)
Estate well-known: GET https://councilof.ai/.well-known/x402.json → 10 resources · mode live
OpenAPI: https://councilof.ai/openapi.json
Free-door: https://councilof.ai/api/free-door (402 amount 0 · bazaar)
Free crawl: https://councilof.ai/api/feeds/provider-diff (200 JSON · not a paid OX resource)
Catalog: https://councilof.ai/api/x402
Measurement, never certification. Self≠revenue. Never clone PayAI.

Owner: N-Sites spray onto HF leftovers / registry printers. OX discovery stays 0 until settle-through — never invent. Stamp 2026-09-14T03:29Z.

Smithery / MCP door (measured 2026-09-14 — not a certification)

• Primary free MCP door: https://councilof.ai/mcp — GET 200; tools/list = 12 tools (matches registry tools[] for csoai/gspc-mcp).
• Smithery primary listing: https://smithery.ai/server/csoai/gspc-mcp · registry https://registry.smithery.ai/servers/csoai/gspc-mcp — deploymentUrl=https://gspc-mcp--csoai.run.tools → GET/POST 401 invalid_token (Smithery auth required). Prefer the public door above; do not treat run.tools as the free door.
• Stale duplicate: https://smithery.ai/server/csoai/gspc · registry https://registry.smithery.ai/servers/csoai/gspc — tools[] includes phantoms measure|verify|jail-probe|enter-arena (not on live /mcp); deploymentUrl=https://gspc--csoai.run.tools also 401. Prefer archive/unlist; keep only csoai/gspc-mcp.
• Registry write: PATCH/DELETE need Authorization — no free write without Nick Smithery login (HARD BLOCKER if token absent).
• Measurement only. Never invent that Smithery was fixed. Never certify.

Signed measurement archive (free cite · never a grade)

Living board: GET https://councilof.ai/api/gspc → 22 axis · 22 measured · lid: 22 axes measured · 14 model fleets · 3 public leader scores · 8 fact runs · TIE is TIE · not a certificate.
Signed card index: GET https://councilof.ai/signed/card_index.json → n_cards=335 · schema csoai.gspc-card-index/0.1
How to verify (stranger): https://councilof.ai/signed/HOW-TO-VERIFY.md
Free verify UI: https://councilof.ai/gspc-verify/
Example SIGNED card: https://councilof.ai/signed/cards/cff1aaf070acb97c224177809856bc20310f4958eb44bdffab7d4b04836535f4.json
Hub census (≠ board ≠ card_index): GET https://councilof.ai/api/hub-cards → 131/131/0
HF printers: https://huggingface.co/datasets/csoai/gspc-hub-cards · https://huggingface.co/datasets/csoai/gspc-jail-goldbank
Supply-led: CSOAI measures public systems independently first; sells delivery/freshness/monitoring/integration/replay/extra compute — never grades or favourable results.
Measurement credential, never certification. Free refresh only.

Owner: N-Sites — free paste onto HF/Kaggle printers. Hub LIVE 131 (kill 1191/1196). card_index n=335. Never invent VC/revenue. Stamp 2026-09-14T10:37Z.